IBM, Red Hat start $5 B Lightwell to secure open‑source code

IBM and its subsidiary Red Hat have launched a $5 billion initiative, called Project Lightwell, to improve the security of open source software across enterprise supply chains. The project will deploy more than 20,000 engineers and advanced artificial intelligence to create a centralized clearinghouse for discovering, validating, and remediating vulnerabilities.

The initiative aims to address a critical and growing security challenge. Open source software is foundational to modern technology, with more than 90% of Fortune 500 companies relying on it. However, its widespread use has made it a prime target, with hundreds of thousands of malicious packages identified last year and a high percentage of codebases containing high-risk vulnerabilities. The volume and complexity of these threats have created an unsustainable gap between finding flaws and fixing them.

Project Lightwell is designed to close this remediation gap by acting as an AI-powered security coordination layer. It will deliver validated security patches directly into the specific versions of open source software that companies already use in production, a process known as backporting. This approach is intended to...